
WHAT IS CLAIMED IS: 

^ A secure parameter generating device in an 

algebraic curve cryptography, comprising: 

an input means for receiving two different prime 
numbers (a, b) specifying degree of complexity of a 
curve and size (n) of an encryption key to be used; 

a Stickelberger element computing device for 
computing a Stickelberger element ( co ) in an ab 
cyclotomic, based on the prime number (a) and the prime 
number ( b ) ; 

a Jacobian addition candidate value computing 
device for computing Jacobian addition candidate value j 
corresponding to the two different prime ^numbers a and b, 
and a prime number p corresponding to the Jacobian 
addition candidate value j , based on the prime number 
(a), the prime number (b), the size (n) of an encryption 
key, and the Stickelberger element (co) ; 

an order candidate value computing device for 
computing a class H consisting of a plurality of 
candidate values for order of a Jacobian group of an 
algebraic curve specified by the prime number a and the 
prime number b, based on the prime number a, the prime 
number b, and the Jacobian addition candidate value j; 

a security judging device for searching for a 
candidate value h meeting a security condition such ^as 
almost prime number characteristic from the class H, 



according to the class H; 

a parameter deciding device for computing a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p, based on the 
prime number a, the prime number b, the prime number p, 
and the candidate value h; and 

an output device for supplying the parameter of 
the algebraic curve computed by said parameter deciding 
device . 

2 , A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

an a-storing means, a b-storing means, and an n- 
storing means for respectively storing the prime number 
a, the prime number b, and the size n of the encryption 
key received by said input means; 

a CO -storing means for storing a Stickelberger 
element co computed by said Stickelberger element 
computing device; 

a p-storing means and a j -storing means for 
respectively storing the prime number p and the Jacobian 
addition candidate value j computed by said Jacobian 
addition candidate value computing device; 

an H-storing means for storing the class H 
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coitiputed by said order candidate value computing device; 
and 

an h-storing means for storing the candidate 
value h found by said security judging device. 

3 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation 00 = 2^ [<t/a> + <t/b>] a_{-t"^> (where, t runs 
on a typical series of irreducible residue class with ab 
W1 used as a divisor, [ A ] indicates the maximum integer not 

m 

exceeding a rational number A, <A> indicates a 
Cj 10 fractional portion A-[A] of the rational number A, 

m 

P^J indicates Galois mapping C ~^ C ^ in the ab cyclotomic 

ill 

0 (C is the primitive ab root of 1)), based on the prime 
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number a and the prime number b. 



4 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Jacobian addition candidate value computing 
5 device for generating a at random, which is an algebraic 

integer r generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 



2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = r ^ . 

5. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] a__{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ~^ C ^ in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said Jacobian addition candidate value computing 
device for generating o; at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 



Jacobian addition candidate value j by use of the 
equation j = r"^. 

6 • A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said order candidate value computing device for 
computing a candidate value h^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h,^ = NormK|Q( 1+ (- 
^ )^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... ,h2ab}- 

7 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation CO = [<t/a> + <t/b>] cr_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A , < A > indicates a 
fractional portion A-[A] of the rational number A, 
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indicates Galois mapping C ^ C ^ in the ab cyclotomic 
(C is the primitive ab root of 1))^ based on the prime 
number a and the prime number b; and 

said order candidate value computing device for 
computing a candidate value h,^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h^ = Norm^iQC 1+ (- 
^ )^ 3) (where Norm__{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... ,h2ab}* 

8 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer r generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ (a-1 ) (b-1 ) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T ^ ; and 
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said order candidate value computing device for 
computing a candidate value hj, for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation hj, = NormK|Q( 1+ (- 
^ )^ 3) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when ^ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... ^hjab}* 

9 . A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] a_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ~^ C ^ in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer r generating a prime ideal of a cyclotomic K 



generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ (a-1 ) (b-1 ) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the SticJcelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j ~ T ; and 

said order candidate value computing device for 
computing a candidate value h,^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h,^ = NormK|Q( 1+ (- 
^ )^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, whenCis the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... f^2ab} • 

10, A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said parameter deciding device for requiring the 
primitive a root C a and the primitive b root ^ of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 



+ C b"" + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer iti from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Ca^f and ^ 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

11. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] a_{-t"^> (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ^ in the ab cyclotomic 

(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; and 

said parameter deciding device for requiring the 
primitive a root C a arid the primitive b root C b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 



p, and the candidate value generating a random point 
G over an algebraic curve defined by the equation C 
+ C ty"^ 1 ~ 0 , as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Ca^f ^ 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

12. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer T generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T ; and 

said parameter deciding device for requiring the 
primitive a root C a arid the primitive b root C b of 1 



with the prime number p used as the divisor^ based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ Cb"" X*" +1 = 0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C/, and S 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

13. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising: 

said order candidate value computing device for 
computing a candidate value h,^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation hj, = NormK|Q( 1+ (- 
^)*' j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, whenCis the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... ,h2ab}; ^r^d 



said parameter deciding device for requiring the 
primitive a root C a arid the primitive b root ^ ^ of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ Cb"* +1=0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Ca^f and £ 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

14. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Stickelberger element computing device for 
computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] a_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ^ C ^ in the ab cyclotomic 



( C is the primitive ab root of 1 ) ) r based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer 7 generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/(a-l) (b-1) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T ; and 

said parameter deciding device for requiring the 
primitive a root C a and the primitive b root of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C X*" + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C f and £ 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



15. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Stickelberger element computing device for 
computing the Stickelberger element O) by use of the 
equation co = [<t/a> + <t/b>] c^_{-t'^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ~^ C ^ in the ab cyclotomic 
( C is the primitive ab root of 1 ) ) , based on the prime 
number a and the prime number b; 

said order candidate value computing device for 
computing a candidate value h,, for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation hj, = NormK|Q( 1+ (- 
^ )^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... fhjab); arid 

said parameter deciding device for requiring the 
primitive a root ^^id the primitive b root of 1 
with the prime number p used as the divisor, based on 



the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C b"" + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Ca^f ^rid C b"" 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group, 

16. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 
further comprising : 

said Jacobian addition candidate value computing 
device for generating a at random, which is an algebraic 
integer T generating a prime ideal of a cyclotomic K 
generated by the primitive ab root of 1 and whose 
absolute norm becomes the prime number p of bit length 
2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, the 
prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation 3 = 7"^; 

said order candidate value computing device for 



computing a candidate value hj, for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and using the equation h^ = Norn^t|Q( 1+ (- 
S j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... /hjab}? 

said parameter deciding device for requiring the 
primitive a root K> a and the primitive b root ^ ot 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation K> 
+ C b"" + 1 = 0 f as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, K> ^ , and C b"* 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

17. A secure parameter generating device in an 

algebraic curve cryptography as claimed in Claim 1, 



further comprising : 

said Stickelberger element computing device for 
5 computing the Stickelberger element co by use of the 

equation a; = [<t/a> + <t/b>] cr_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
10 fractional portion A-[A] of the rational number A, 

indicates Galois mapping C ~^ C ^ in the ab cyclotomic 
P ( C is the primitive ab root of 1 ) ) , based on the prime 

0' number a and the prime number b; 

y1 said Jacobian addition candidate value computing 

m 

15 device for generating a at random, which is an algebraic 

m 

^ integer r generating a prime ideal of a cyclotomic K 

CJ 

generated by the primitive ab root of 1 and whose 

* 

i|» absolute norm becomes the prime number p of bit length 

2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, the 

20 prime number b, the size n of the encryption key, 

and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation 3 = T ; 

said order candidate value computing device for 

25 computing a candidate value h^ for the order of the 

Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h,, = NormK|Q( 1+ (- 
^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 



to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... /hjab)? srid 

said parameter deciding device for requiring the 
primitive a root C a arid the primitive b root ^ ^ of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C b"" + 1 = 0 / f each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C a^/ C b"" 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

A secure parameter generating method in an 
algebraic curve, comprising the steps of: 

a Stickelberger element computing procedure for 
computing a Stickelberger element co in an ab cyclotomic, 
respectively based on two different prime numbers a and 
b specifying degree of complexity of curve; 

a Jacobian addition candidate value computing 



procedure for computing Jacobian addition candidate 
value j corresponding to the two different prime numbers 
a and b, and a prime number p corresponding to the 
Jacobian addition candidate value j , respectively based 
on the prime number a, the prime number b, the size n of 
an encryption key, and the Stickelberger element co ; 

an order candidate value computing procedure for 
computing a class H consisting of a plurality of 
candidate values for order of a Jacobian group of an 
algebraic curve specified by the prime number a and the 
prime number b, respectively based on the prime number a, 
the prime number b, and the Jacobian addition candidate 
value j ; 

a security judging procedure for searching for a 
candidate value h meeting a security condition such as 
almost prime number characteristic from the class H, 
according to the class H; and 

a parameter deciding procedure for computing a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p, respectively 
based on the prime number a, the prime number b, the 
prime number p, and the candidate value h. 

19. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
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further comprising: 

a procedure for storing a Stickelberger element 
CO computed by said Stickelberger element computing 
procedure into said co -storing means; 

a procedure for respectively storing the prime 
number p and the Jacobian addition candidate value j 
computed by said Jacobian addition candidate value 
computing procedure into said p-storing means and j- 
storing means; 

a procedure for storing the class H computed by 
said order candidate value computing procedure into said 
H-storing means; and 

a procedure for storing the candidate value h 
found by said security judging procedure into said h- 
storing means, 

20. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
for computing the Stickelberger element (o by use of the 
equation co = [<t/a> + <t/b>] a_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ^ C ^ in the ab cyclotomic 



is the primitive ab root of 1)), based on the prime 
number a and the prime number b. 

21. A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Jacobian addition candidate value computing 
procedure for generating ot at random, which is an 
algebraic integer T generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T . 

22. A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] c;_{-f^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A -[A] of the rational number A, 



indicates Galois mapping C ^ C ^ in the ab cyclotomic 
( C is the primitive ab root of 1 ) ) ^ based on the prime 
number a and the prime number b; and 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer T generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T • 

23. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said order candidate value computing procedure 
for computing a candidate value h^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h^ = Norm^iQC l-i- (- 
^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j, and computing the 
class of the candidate values, H={hi,h2,... /h2ab}. 




24. A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation 00 = 2^ [<t/a> + <t/b>] cr_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C — ^ C ^ in the ab cyclotomic 
( C is the primitive ab root of 1 ) ) , based on the prime 
number a and the prime number b; and 

said order candidate value computing procedure 
for computing a candidate value h^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation hj^ = Norm^jQC 1+ {- 
C j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... fhjab}* 

25, A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 



further comprising: 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer r generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j - T ; and 

said order candidate value computing procedure 
for computing a candidate value hj, for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h,^ = Normj^|Q( 1+ (- 
C )^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... /hjab). 

26. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
for computing the Stickelberger element (jo by use of the 



equation co = Et [<t/a> + <t/b>] a_{-t-l} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ^ in the ab cyclotomic 

(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 
procedure for generating ct at random, which is an 
algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) ( b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T'*'; and 

said order candidate value computing procedure 
for computing a candidate value hj^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h^ = Normj^|Q( 1+ (- 
C j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
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class of the candidate values, H={hi,h2,... ^hjab)* 

27. A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said parameter deciding procedure for requiring 
the primitive a root ^ ^ and the primitive b root Cy, of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C b"" + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Ca^^ C b"* 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

28. A secure parameter generating method in an 
algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] o _{-t~^} (where, t runs 



# # 



on a typical series of irreducible residue class with ab 
used as a divisor, [A] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ~^ C ^ in the ab cyclotomic 

is the primitive ab root of 1))/ based on the prime 
number a and the prime number b; and 

said parameter deciding procedure for requiring 
the primitive a root C a ^rid the primitive b root C ^ of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C b"* 1 = 0 / fo^ each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Ca^, and C b"* 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

29, A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Jacobian addition candidate value computing 
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procedure for generating a at random, which is an 
algebraic integer T generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element (o , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T'^; and 

said parameter deciding procedure for requiring 
the primitive a root C a and the primitive b root C b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C b"" + 1 = 0 / for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C f and C b"* 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

30* A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 



further comprising : 

said order candidate value computing procedure 
for computing a candidate value h,^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h^ == Norm^iQC 1+ (- 
^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a/ the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... fh2ab>; ^rid 

said parameter deciding procedure for requiring 
the primitive a root C a and the primitive b root C ^ of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C + 1 = 0 f as for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C J' , and C b"* 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



31. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] a__{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A -[A] of the rational number A, 
indicates Galois mapping C ^ C ^ in the ab cyclotomic 
( C is the primitive ab root of 1 ) ) , based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer T generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element O) , and computing the 
Jacobian addition candidate value j by use of the 
equation j = T'^; and 

said parameter deciding procedure for requiring 
the primitive a root C a ^^^d the primitive b root of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
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p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ ^^"^ -^1 = 0, as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point and supplying p, Ca^/ C b"" 

as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

32. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation 00 = 2^ [<t/a> + <t/b>] a_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ~^ C ^ in the ab cyclotomic 

is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said order candidate value computing procedure 
for computing a candidate value h^ for the order of the 



Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation hj, = NormK|Q( 1+ (- 
C )^ j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... /hjab); 

said parameter deciding procedure for requiring 
the primitive a root C a ^^id the primitive b root of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C b"" + 1 = 0 , as for each integer 1 from 1 to a 
inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C , and C b"" 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

33. A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising : 




said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer T generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 ; 

said order candidate value computing procedure 
for computing a candidate value h^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation hj^ = Norm^iQC 1+ (- 
^ )^ j) (where Norm__{K|Q} is a norm mapping in the ab 
cyclotomic K), as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
class of the candidate values, H={hi,h2,... fhjab}/ 

said parameter deciding procedure for requiring 
the primitive a root C a ^^id the primitive b root S b of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C + 1 = 0 , as for each integer 1 from 1 to a 



inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, Ca^/ ^rid C b"" 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

34* A secure parameter generating method in an 

algebraic curve cryptography as claimed in Claim 18, 
further comprising: 

said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation co = [<t/a> + <t/b>] a_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational number A, 
indicates Galois mapping C ^ C in the ab cyclotomic 
(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b; 

said Jacobian addition candidate value computing 
procedure for generating a at random, which is an 
algebraic integer T generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 



length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation 3 - T^; 

said order candidate value computing procedure 
for computing a candidate value hj^ for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h,^ = Norm^igC 1+ (- 

3) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when C is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j, and computing the 
class of the candidate values, H={hi,h2,... /h2ab}; and 

said parameter deciding procedure for requiring 
the primitive a root C a the primitive b root of 1 

with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 
G over an algebraic curve defined by the equation C 
+ C 1 = 0 f for each integer 1 from 1 to a 

inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C^^, and C b"*. 
as the parameter of an algebraic curve whose order of 
the Jacobian group is in accord with the candidate value 
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h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 

^ computer readable memory storing a program for 
generating a secure parameter in an algebraic curve 
cryptography, to run the program on a computer, 

the program comprising the steps of: 

a Stickelberger element computing procedure for 
computing a Stickelberger element in an ab cyclotomic, 
respectively based on two different prime numbers a and 
b specifying degree of complexity of curve; 

a Jacobian addition candidate value computing 
procedure for computing Jacobian addition candidate 
value j corresponding to the two different prime numbers 
a and b, and a prime number p corresponding to the 
Jacobian addition candidate value j , respectively based 
on the prime number a, the prime number b, the size n of 
an encryption key, and the Stickelberger element co ; 

an order candidate value computing procedure for 
computing a class H consisting of a plurality of 
candidate values for order of a Jacobian group of an 
algebraic curve specified by the prime number a and the 
prime number b, respectively based on the prime number a, 
the prime number b, and the Jacobian addition candidate 
value j ; 

a security judging procedure for searching for a 



candidate value h meeting a security condition such as 
almost prime number characteristic from the class H, 
according to the class H; and 

a parameter deciding procedure for computing a 
parameter of an algebraic curve whose order of the 
Jacobian group is in accord with the candidate value h, 
of the algebraic curves specified by the prime number a, 
the prime number b, and the prime number p, respectively 
based on the prime number a, the prime number b^ the 
prime number p, and the candidate value h. 

2^. A computer readable memory storing a program for 

generating a secure parameter in an algebraic curve 
cryptography , 

the program comprising the steps of: 
said Stickelberger element computing procedure 
for computing the Stickelberger element co by use of the 
equation 60 = 2^ [<t/a> + <t/b>] a_{-t"^} (where, t runs 
on a typical series of irreducible residue class with ab 
used as a divisor, [ A ] indicates the maximum integer not 
exceeding a rational number A, <A> indicates a 
fractional portion A-[A] of the rational nuxt±>er A, 
indicates Galois mapping C ^ in the ab cyclotomic 

(C is the primitive ab root of 1)), based on the prime 
number a and the prime number b. 




A computer readable memory storing a program for 
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generating a secure parameter in an algebraic curve 
cryptography , 

the program comprising the steps of: 
said Jacobian addition candidate value computing 
procedure for generating Of at random, which is an 
algebraic integer 7 generating a prime ideal of a 
cyclotomic K generated by the primitive ab root of 1 and 
whose absolute norm becomes the prime number p of bit 
length 2n/ ( a-1 ) (b-1 ) or so, based on the prime number a, 
the prime number b, the size n of the encryption key, 
and the Stickelberger element co , and computing the 
Jacobian addition candidate value j by use of the 
equation j = 7 • 

A computer readable memory storing a program for 
generating a secure parameter in an algebraic curve 
cryptography , 

the program comprising the steps of: 
said order candidate value computing procedure 
for computing a candidate value h,, for the order of the 
Jacobian group of an algebraic curve specified by the 
parameters a and b, using the equation h^ = NormK|Q( 1+ (- 
C j) (where Norm_{K|Q} is a norm mapping in the ab 
cyclotomic K) , as for each k that is an integer from 1 
to 2ab inclusively, when £ is the primitive ab root of 1, 
based on the prime number a, the prime number b, and the 
Jacobian addition candidate value j , and computing the 
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class of the candidate values, H={hi/h2/..- /hjab}* 

39. A computer readable memory storing a program for 

generating a secure parameter in an algebraic curve 
cryptography , 

the program comprising the steps of: 
said parameter deciding procedure for requiring 
the primitive a root C a ^r^d the primitive b root ^ ^ of 1 
with the prime number p used as the divisor, based on 
the prime number a, the prime number b, the prime number 
p, and the candidate value h, generating a random point 



iPi 10 G over an algebraic curve defined by the equation C J' 

m 

^1 + ^ b"* + 1 = 0 f as for each integer 1 from 1 to a 



inclusively and each integer m from 1 to b inclusively, 
computing the h-fold of an element in the Jacobian group 
indicated by the point G, and supplying p, C^^, and C 



m 

CI 

m 
m 

15 as the parameter of an algebraic curve whose order of 

the Jacobian group is in accord with the candidate value 
h, of the algebraic curves specified by the prime number 
a and the prime number b if the result is equal to an 
identity element in the Jacobian group. 



